HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Pennsylvania Ambulatory Surgery Center Alerts 13K Patients to Ransomware Attack

Langhorne, PA-based Ambulatory Surgery Center at St. Mary has announced that it was the victim of a ransomware attack on June 1, 2016, according to the Bucks County Courier Times.

The IT department was alerted to the ransomware infection by staff members who were prevented from accessing files stored on its computer network. While other ransomware victims have been forced to give in to attacker’s demands in order to recover encrypted files, the Ambulatory Surgery Center was able to restore all affected files from a backup and did not have to resort to paying the ransom demand.

As was confirmed this week by the Department of Health and Human Services’ Office for Civil Rights, a ransomware attack on a healthcare organization requires notifications to be sent to patients to alert them to the possible disclosure of their protected health information.

The Ambulatory Surgery Center sent breach notification letters to almost 13,000 patients last week to advise them that their PHI may have been accessed. All individuals affected by the security breach have been offered credit monitoring services to allow them to monitor for any fraudulent use of their data.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

According to a statement from a spokesperson for the Ambulatory Surgery Center, the ransomware attack was unlikely to have been used as a means to gain access to patient data.  “In most cases, ransomware is not utilized for the purposes of accessing personal identification information. However, since the ransomware did access our network, we need to notify you just in case other information was accessed.”

Many ransomware campaigns install malware in addition to ransomware. Data security threats can therefore remain after encrypted files have been restored from backups. It is therefore essential – and a requirement of HIPAA – to perform a full risk assessment after a ransomware infection and to audit systems to determine whether any data security risks remain.

The Ambulatory Surgery Center is in the process of conducting an internal audit to ensure that no further malware was installed and no backdoors remain which could allow the attackers to access patient data or cause any further harm or damage.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.